Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Single Sign-On on RHEL 7: Unauthorized Access to Sensitive Data

published 2 years ago

Summary

A security update is available for Red Hat Single Sign-On on Red Hat Enterprise Linux 7. This update fixes a vulnerability that could allow an attacker to access sensitive data without proper authorization. To stay secure, apply the latest update to Red Hat Single Sign-On on your RHEL 7 system.

What to do

Update redhat rh-sso7-keycloak to version 0:15.0.8-1.redhat_00001.1.el7sso.
Update redhat rh-sso7-keycloak-server to version 0:15.0.8-1.redhat_00001.1.el7sso.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:red_hat_single_sign_on:7.5::el7	redhat	rh-sso7-keycloak	< 0:15.0.8-1.redhat_00001.1.el7sso Fix: upgrade to 0:15.0.8-1.redhat_00001.1.el7sso
Red Hat:red_hat_single_sign_on:7.5::el7	redhat	rh-sso7-keycloak-server	< 0:15.0.8-1.redhat_00001.1.el7sso Fix: upgrade to 0:15.0.8-1.redhat_00001.1.el7sso

Original advisory text

Red Hat Security Advisory: Red Hat Single Sign-On 7.5.3 security update on RHEL 7

References

https://access.redhat.com/errata/RHSA-2022:6782 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2031958 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2039403 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2040268 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2060929 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064226 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064698 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2101942 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2115392 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6782.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2020-36518 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-36518 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-36518 Vendor Advisory
https://github.com/advisories/GHSA-57j2-w4cx-62h2 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-42392 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-42392 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-42392 Vendor Advisory
https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-43797 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-43797 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-43797 Vendor Advisory
https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-0084 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0084 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0084 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-0225 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0225 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0225 Vendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-0866 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0866 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0866 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-2256 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-2256 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2256 Vendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-2668 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-2668 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2668 Vendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Timeline

Published29 Sep 2024

Updated26 Mar 2026

First seen26 Mar 2026

Sources

RHSA-2022:6782 · OSV

Track software like this

Free during beta